Bank Account Hacked? What to Do First

If money has moved out of your checking account or someone else is logging in, the order of the next hour matters more than anything else you will do. The bank comes first, then the credentials, then the devices, then the written record. This guide sets out that order, explains why the reporting date is what decides how much you can be asked to carry, and covers what the bank has to do once you have told it.

By Prudents·6 min read

September 21, 2026, 7:21 PM·Updated September 24, 2026, 5:21 PM

A man sitting in the open door of his parked car making a phone call while holding a bank card

The first hour, in order

Call the bank before you do anything else, including changing your password. Freezing the account and flagging the transactions is what stops more money leaving, and the protections that limit what you owe are tied to when you reported. The OCC’s instruction is to notify the bank immediately and identify by date and dollar amount the transactions you did not authorize, and it says your promptness in notifying the bank is critical to limiting your liability.

Call the bank’s fraud line now. Use the number on the back of your card, on a statement, or in the official app, not a number from a search result or from whoever contacted you. Ask them to freeze the account or the card, block pending transfers if any are still pending, and open a fraud claim. Write down the claim number and the name of the person you spoke to.
Name every transaction you do not recognize, by date and amount, including small ones. Ask them to check for new payees, new linked external accounts, changed contact details, and new device logins, because those are how a takeover keeps working after one card is blocked.
Ask what they need in writing and by when. Most banks send an affidavit of unauthorized use with its own deadline. Ask for the address and the deadline on this call.
Change the password on the email account first, then the bank. Password resets land in email, so an email account still under someone else’s control undoes every other change. Use a device you have reason to trust.
Turn on two-step verification wherever it is not already on, starting with email and the bank. The FTC’s guide to two-factor authentication explains the methods and which are strongest.
Write down what happened while it is fresh. Times, amounts, what you clicked or answered, who called you. This becomes the report and, later, the evidence.

If you are not sure whether the account is actually compromised or you simply do not recognize a merchant name, still call. A bank can tell you in two minutes what a search cannot, and a false alarm costs nothing.

Why reporting fast matters more for a bank account

Money taken from a checking account is money already gone while the claim is investigated, and federal protections for it are written as a schedule that gets worse the longer you wait. That is the difference from a credit card, where the disputed amount is a charge the issuer has not yet collected from you.

The CFPB describes the debit card schedule this way: report within two business days of learning about a lost or stolen card and the bank cannot hold you responsible for more than $50. Report after two business days and the amount can rise to $500. Fail to report within 60 days after the statement was sent, and you can be responsible for everything taken after that period. The FTC publishes the same schedule for ATM and debit cards, and adds that after 60 calendar days you may also lose money in accounts linked to the debit account.

For unauthorized transfers made without a card at all, which is what most account takeovers look like, the CFPB points to the 60-day statement rule as the one that governs. That is why the statement, not your memory, is the clock.

Three different rulebooks, one wallet

A credit card, a debit card, and a wire transfer are not covered by the same rules. The FTC states that for credit cards federal law limits your responsibility for unauthorized charges to $50. A debit card follows the reporting schedule above, and the money is out of your account meanwhile. A wire you sent yourself is a different situation again, built to be fast and hard to reverse, and our guide to wire transfer scams covers the recall request and what it can realistically do.

Hands typing a new password on a laptop at a kitchen table, screen out of focus — Illustrative scene: new credentials only hold once the devices still signed in have been signed out.

Changing credentials in the right order

Email first, then the bank, then anything that can reset the bank. Doing it in a different order means resetting a password that someone else can immediately reset again, which is the most common way a takeover survives the first cleanup.

Give every one of these accounts its own password, not a variation of one you already use. The FTC recommends passwords of at least 12 characters and notes that protecting the email account matters most, because password reset links go to the inbox and a hacker who controls email can get reset links for everything else.

While you are in each account, look at the settings rather than only the password. Check for forwarding rules on email, unfamiliar recovery phone numbers and addresses, app passwords, and active sessions on other devices. Sign out of all sessions where the option exists. Then remove any payee, linked account, or standing transfer you did not set up.

If text messages are how you receive login codes, be aware that the phone number itself can be the target. Sudden loss of cell service with no explanation is a sign worth taking seriously, and our guide to SIM swap scams covers what to ask the carrier and what to change.

Checking the devices

Do the credential changes from a device you have reason to trust, then look at the device you normally bank on. If someone was given remote access, or software was installed, new passwords typed on that machine can be captured as you type them.

Remote access is the specific thing to rule out. If anyone recently walked you through installing a screen-sharing or support application, uninstall it and disconnect the device from the network first. That pattern is the turning point in a common scam, described in our guide to refund scams, where a fake overpayment is used to get onto the screen and into the account.

Then do the routine cleanup. The FDIC’s guidance is to make sure operating systems and applications are up to date, because older and unpatched versions are the target of many attacks, and to run software providing antivirus, firewall, and email filter services. Remove browser extensions and applications you do not recognize, and check what is installed on the phone as well as the computer.

If you cannot tell whether a device is clean, do your banking from a different one until you can. A bank login on a questionable device undoes the rest of the work.

Put the report in writing

The phone call starts the clock, and the written notice is what proves the date. Send the bank a short written report even if the call went well and even if the bank did not ask for one, and keep a copy.

The OCC advises consumers to notify the bank in writing of the error and keep a copy for your records. Keep the letter factual: your name and account number, each unauthorized transaction by date and amount, the date and time of your phone call, the claim number, and what you are asking for.

If the bank sent an affidavit of unauthorized use, complete it and return it inside its deadline. That deadline is separate from any statutory window, and a claim can stall on a missing affidavit even when everything else was done on time.

From here on, keep one running log: every call, the date, the name, the reference number, and what was said. Save statements showing the disputed transactions before they scroll out of the online history. Banks change case handlers, and the file you keep is the one that never gets lost.

What the bank does next, and how long it takes

The bank investigates and has a defined window to decide, and in many cases it has to put the money back temporarily while it works. The OCC states that a bank can generally take up to 10 business days after being notified of a potential error to determine if an error has occurred, and should respond to you within three business days of completing its investigation.

If it cannot decide inside that window, the same OCC page says it may take up to 45 days from the date it was notified, and in that case it must provisionally reimburse your account while it continues. The CFPB describes the provisional credit the same way and notes that the period can run longer in certain situations, including a new account and some point-of-sale and foreign transactions.

A provisional credit is not a final decision. If the bank concludes there was no error, it can take the money back after telling you, and you can ask for the documents it relied on. That is the moment to send anything you have that the bank did not see.

It is honest to say that not every claim is resolved in the customer’s favor. Transactions the bank treats as authorized, including ones a person was talked into making, are handled differently from transactions nobody in your household initiated. Describing exactly what happened, in plain terms, helps more than choosing the word you think will work.

What to check in the days after

Watch for the second wave. A compromise that reached one account often reached the information behind it, and the follow-up shows up somewhere else: a new account opened in your name, a card you did not order, a change of address notice you did not request.

Read every account statement line by line for the next few cycles, not just the balance. The CFPB advises making a habit of monitoring your accounts and warns that small test charges often come before large ones. Turn on transaction alerts so the next one reaches you in seconds instead of at the next statement, which is the core of our guide to safe online banking.

Check whether the card itself may have been copied somewhere physical rather than online, which our guide to card skimming covers. And if accounts are being opened rather than only drained, treat it as identity theft and follow the steps in how to report identity theft.

Be careful with anyone who contacts you offering to recover the money, especially for a fee paid up front. People who have just reported a loss are contacted by a second set of criminals, and no agency charges to get your money back.

Where to report outside the bank

The bank claim is what can move money. The outside reports build the record, feed investigations, and give you somewhere to escalate if the bank stops answering.

Report the fraud to the FTC at ReportFraud.ftc.gov. If personal information was used to open accounts, use IdentityTheft.gov, the FTC’s free recovery process, which produces a report you can send to creditors. For fraud with an online component, the FBI takes complaints at IC3.gov. A police report is worth filing when a creditor or the bank asks for one.

If the bank will not resolve the claim, complain to its federal regulator. For national banks and federal savings associations that is the OCC, through HelpWithMyBank.gov. Federal Reserve Consumer Help takes complaints and routes them to the agency that supervises your institution when you do not know which one that is. Neither acts as a court, and neither can promise a reversal, but a regulator asking a bank to explain itself changes the conversation.

Hacked bank account FAQ

Should I call the bank or change my password first?

Call the bank first. Freezing the account is what stops more money leaving, and the federal protections that limit what you can be asked to carry are tied to when you reported. Change the email password next, then the bank password, because reset links go to the inbox.

Will the bank give my money back?

Often, but it is not guaranteed and it depends on what happened. The rules cap what you can be asked to carry rather than promising a refund on a date. The OCC says a bank generally has up to 10 business days to determine whether an error occurred, and if it needs longer it may take up to 45 days while provisionally reimbursing your account.

How long do I have to report an unauthorized transaction?

Report it immediately. The CFPB describes a schedule for debit cards: within two business days of learning of a lost or stolen card your responsibility is capped at $50, later reporting can raise it to $500, and failing to report within 60 days after the statement was sent can leave you paying for everything taken after that period.

Do I need to close the account or is a new card enough?

That depends on how the access happened, and the bank is the one who can tell you. A new card helps when only the card number was used. If the online banking login itself was compromised, or new payees and linked accounts appeared, ask about a new account number as well.

What if I sent the money myself after someone called me?

Still call the bank immediately, because some payments can be stopped or recalled if they have not settled. A transfer you were talked into making is treated differently from one you never initiated, so describe exactly what happened rather than guessing at the right label. Recovery is possible in some cases and never certain.